Lynx
Data as of August 16, 2026.
Credential exposure before the attack
40.3% of Lynx victims whose domain we can identify (157 of 390) had employee credentials leak in the 12 months before Lynx named them as a victim.
We don't know whether any of these credentials were how Lynx gained initial access.
What industries Lynx targets
Sector identified for 234 of 390 victims.
| Manufacturing | 56 | |
| Construction | 38 | |
| Financial Services | 20 | |
| Legal | 20 | |
| Logistics | 19 | |
| Healthcare | 13 | |
| Hospitality | 10 | |
| Government | 9 |
Where the victims are located
Country identified for 195 of 390 victims.
| United States | 77 | |
| Canada | 18 | |
| United Kingdom | 14 | |
| Germany | 12 | |
| Australia | 11 | |
| Italy | 8 | |
| France | 6 | |
| Spain | 6 |
Most recent Lynx victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Jerry Leigh jerryleigh.com | Manufacturing | United States | Aug 7, 2026 |
| Talbot County Department of Emergency Services talbotdes.org | Healthcare | United States | Aug 7, 2026 |
| Easterseals Iowa eastersealsia.org | Non-profit | United States | Jun 19, 2026 |
| Southern Mechanical Contractors someco.com | Construction | United States | Jun 19, 2026 |
| Wolf Construction wolfconstruction.net | Construction | United States | Jun 18, 2026 |
| CommonWealth Partners commonwealth-partners.com | Financial Services | United States | Jun 12, 2026 |
| Bay Area Herbs bayareaherbs.com | Not identified | United States | May 11, 2026 |
| CSB Battery csb-battery.com | Manufacturing | Taiwan | May 11, 2026 |
| Funky Chunky funkychunky.com | Not identified | United States | May 11, 2026 |
| Jackson County Visitor Center jacksoncountyin.com | Government | United States | May 11, 2026 |
| Kurita Europe kurita.eu | Manufacturing | Germany | May 11, 2026 |
| Lifelong Access lifelongaccess.org | Non-profit | United States | May 11, 2026 |
| OS Sistemes ossistemes.com | Manufacturing | Spain | May 11, 2026 |
| St Annes Catholic School and Sixth Form College st-annes.uk.com | Education | United Kingdom | May 11, 2026 |
| Stonehenge Inter stonehenge.co.th | Construction | Thailand | Apr 15, 2026 |
| CWW Contractors cwwcontractors.com | Construction | United States | Apr 14, 2026 |
| Sentry Dynamics sentrydynamics.com | Not identified | United States | Apr 14, 2026 |
| ACN Healthcare acnhealthcare.com | Healthcare | United States | Apr 10, 2026 |
| Smith Dollar smithdollar.com | Legal | United States | Apr 8, 2026 |
| New Jersey Public Charter Schools njpcs.org | Education | United States | Mar 27, 2026 |
Showing the 20 most recent of 390. Browse recent data breaches for more.
Lynx leak sites
Addresses we've seen Lynx publish victims from. Any .onion address needs the Tor Browser.
lynxblog.netlynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onionlynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onionlynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onionlynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onionlynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onionlynxbllrfr5262yvbgtqoyq76s7mpztcqkv6tjjxgpilpma7nyoeohyd.onionlynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onionlynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onionlynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onionakiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onionpeargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion
Lynx questions
Is Lynx still active?
Yes. Lynx posted its most recent victim on August 7, 2026. That's 2 victims in the last 30 days.
How many victims has Lynx claimed?
Lynx has named 390 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 116 of them were posted in the last 12 months.
When did Lynx first appear?
The first victim we recorded for Lynx was posted on July 29, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Lynx target?
Manufacturing accounts for the most victims we can classify, with 56. Construction follows at 38. We could identify a sector for 234 of 390 victims, so treat this as the shape of the targeting rather than a full census.
Has Lynx already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.